CVE-2026-67348

Julep contains an insecure direct object reference vulnerability in the getexecutiondetails endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply arbitrary executionid values to retrieve sensitive execution records including task inputs, outputs,...

PT-2026-66498

Julep contains an insecure direct object reference vulnerability in the get execution details endpoint that allows authenticated tenants to read another tenant's execution data. Attackers can supply arbitrary execution id values to retrieve sensitive execution records including task inputs,...

BIT-TEMPORAL-2023-3485 Insecure Default Authorization in Temporal Server

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires t...

Insecure Default Initialization

go.temporal.io/server is vulnerable to Insecure Default Initialization. The vulnerability exists because it does not properly configure the token namespace in service.go, which allows an attacker to create task tokens with access to namespaces in the system...

CVE-2023-3485 Insecure Default Authorization in Temporal Server

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires t...